US20190394040A1

US20190394040A1 - User Security Token Invalidation

Info

Publication number: US20190394040A1
Application number: US16/017,797
Authority: US
Inventors: Jayesh Modi
Original assignee: Elasticsearch Inc
Current assignee: Elasticsearch Inc
Priority date: 2018-06-25
Filing date: 2018-06-25
Publication date: 2019-12-26
Also published as: US11632247B2; US11025425B2; US20210243024A1

Abstract

Provided are methods and systems for invalidating user security tokens. An example method may include providing, by one or more nodes in a cluster, a list of revoked security tokens. The method may include receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user device. The indication may include a request from the user to invalidate the user security token. The method may further include, in response to the receiving, adding, by the one or more nodes, the user security token to the list of revoked security tokens. The user security token can be added to the list of revoked security tokens prior to the expiration time of the user security token. The method may further include replicating, by the one or more nodes, the list of revoked security tokens between further nodes of the cluster.

Description

TECHNICAL FIELD

This disclosure relates to computer security. More specifically, this disclosure relates to systems and methods for invalidating user security tokens.

BACKGROUND

Security of network communication between user devices and remote computing resources, such as servers and computing clouds, has been a major issue. The remote computing resources can be vulnerable to unauthorized access by malicious users. Malicious users can submit intercepted passwords to the remote computing resources in an attempt to receive unauthorized access to the data. Verifiable authentication tokens can be used to prevent such unauthorized access. The tokens can be generated by the remote computing resources and distributed to the user devices. The tokens can be leased to user devices for a period during which the user devices can use the tokens to access services of the remote computing resources. The tokens can be stored as browser cookies or in key stores. However, the tokens themselves can be subject to interception by the malicious users and malicious software and can be used for unauthorized access to data and services of the remote computing resources. Therefore, there is a need for improvement of security by using the verifiable authentication tokens.

SUMMARY

This summary is provided to introduce a selection of concepts in a simplified form that are further described in the Detailed Description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
Generally, the present disclosure is directed to a technology for managing user security tokens in clusters comprising a plurality of computing nodes. Some embodiments of the present disclosure may facilitate preventing security tokens from unauthorized access by third parties.
According to one example embodiment of the present disclosure, a method for invalidating user security tokens is provided. The method may include providing, by one or more nodes in a cluster, a list of revoked security tokens. The method may further include receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user. In response to the receiving the indication, the method may allow adding, by the one or more nodes, the user security token to the list of revoked security tokens. The method may further include replicating, by the one or more nodes, the list of revoked security tokens between further nodes of the cluster.
The indication of invalidating the user security token may include a request from the user to invalidate the user security token. The user security token may include information regarding the user device, an issue time of the user security token, and expiration time of the user security token. The user security token can be generated based on a request from the user. The user security token can be added to the list of revoked security tokens prior to the expiration time of the user security token.
The method may further include determining, by the one or more nodes, that the issue time precedes a predetermined time. In response to the determination, the method may include adding, by the one or more nodes, the user security token to the list of revoked security tokens.
The user security token can be encrypted using an authenticated encryption and a symmetric key. The symmetric key can be a pre-shared key or a key generated at runtime based on a shared secret between the nodes of the cluster. The method may include, upon restarting the cluster, generating, by the one or more nodes, a key to be used for the authenticated encryption. The method may also include, upon restarting the cluster, invalidating, by the one or more nodes, previously issued user security tokens.
A system for invalidating user security tokens is provided. The system can comprise a cluster including one or more nodes. The nodes can be configured to implement operations of the above-mentioned method for invalidating user security tokens.
According to yet another example embodiment of the present disclosure, the operations of the above-mentioned method for invalidating user security tokens are stored on a machine-readable medium comprising instructions, which when implemented by one or more processors, perform the recited operations.
Other example embodiments of the disclosure and aspects will become apparent from the following description taken in conjunction with the following drawings.

BRIEF DESCRIPTION OF DRAWINGS

Exemplary embodiments are illustrated by way of example and not limitation in the figures of the accompanying drawings, in which like references indicate similar elements.

FIG. 1 is a block diagram of an example environment suitable for practicing methods for invalidating user security tokens as described herein.

FIG. 2 is a schematic showing interaction of a user device and a cluster, according to some example embodiments.

FIG. 3 is a block diagram showing an example system for managing user security tokens, according to an example embodiment.

FIG. 4 is a flow chart of an example method for invalidating user security tokens, according to some example embodiments.

FIG. 5 is an example computer system that can be used to implement some embodiments of the present disclosure.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

The technology disclosed herein is concerned with methods and systems for invalidating user security tokens in clusters comprising computing nodes. Embodiments of the present disclosure may facilitate preventing the security tokens from unauthorized use by third parties.
The security tokens can be used in network communication between user devices and clusters including one or more (computing) nodes using stateful or stateless communication protocols. The stateful communication protocols may include a transmission control protocol (TCP), a file transfer protocol (FTP), and others. The stateless communication protocols may include a User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), and others. Stateless communication protocols may not require generating and storing a session state for keeping information regarding a service session between a user device and the clusters.
According to some embodiments of the present disclosure, when a user device sends session requests to the cluster, the two different requests from the same session can be processed by two different nodes of the cluster. Therefore, if a session state is used to store the information concerning the session, the session state should be accessible by all nodes in the cluster or replicated between all nodes of the cluster. This may cause unwanted use of computational resources (processing time of nodes and communication time between the nodes) and delays in generating responses to the session requests. Therefore, using stateless communication protocols can be preferable when the session requests are processed by several nodes in the cluster.
In some embodiments of the present disclosure, upon receiving a new session request from a user device, the cluster can generate a user security token to be used with all further requests associated with the new session. The user security token can include an identifier and information regarding the user device and/or a user of the user device. The user security token may have an expiration time, so it can be used by the user device only within a predetermined period of time. Upon receiving a user security token from the user device, the user security token can be validated or invalidated by any of the nodes of the cluster.
One of the shortcomings of the user security tokens is that there may be a lag between the time the user device stops using the user security token and the time the user security token becomes invalid due to the expiration time. During this lag, the user security token can be used by malicious users and malicious software to gain unauthorized access to the cluster. To prevent an unauthorized use of the security token, the user security token can be invalidated by the cluster immediately after the user device indicates that the user security token is no longer in use.
According to one example embodiment of the present disclosure, a method for invalidating user security tokens may include providing, by one or more nodes in a cluster, a list of revoked security tokens. The method may further include receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user. In response to the receiving of the indication, the method may further allow adding, by the one or more nodes, the user security token to the list of revoked security tokens. The method may further include replicating, by the one or more nodes, the list of revoked security tokens between further nodes of the cluster.
Referring now to the drawings, various embodiments are described in which like reference numerals represent like parts and assemblies throughout the several views. It should be noted that the reference to various embodiments does not limit the scope of the claims attached hereto. Additionally, any examples outlined in this specification are not intended to be limiting and merely set forth some of the many possible embodiments for the appended claims.
FIG. 1 shows a block diagram of an example environment 100 suitable for practicing methods described herein. It should be noted, however, that the environment 100 is just one example and is a simplified embodiment provided for illustrative purposes, and reasonable deviations of this embodiment are possible as will be evident to those skilled in the art.
As shown in FIG. 1, the environment 100 may include one or more user device(s) 110 and at least one cluster 120. In various embodiments, the user device(s) 110 may include, but are not limited to, a laptop computer, a tablet computer, a desktop computer, and so forth. The user device(s) 110 can include any appropriate device having network functionalities allowing the user device(s) 110 to communicate to the cluster 120. In some embodiments, the user device(s) 110 can be connected to the cluster 120 via one or more wired or wireless communications networks.
In some embodiments, the cluster 120 may include a load balancer 130 and one or more computing node(s) 140. The cluster 120 may also include a master node 150. The cluster 120 may further include network switches and/or routers for connecting the load balancer 130, the one or more node(s) 140, and the master node 150.
In some embodiments, the one or more node(s) 140 may be configured to run one or more applications that can be available to the user device(s) 110. Users of the user device(s) 110 can access the applications on the cluster 120 using an Internet browser, a terminal application, a FTP client, and other applications configured to run on the user device(s) 110.
Generally, the user device(s) 110 may send request(s) to the cluster 120. The request(s) can be associated with an application configured to run on the computing node(s) 140. The user requests can be formatted per one or more communication protocols. The communication protocols may include a stateless protocol (for example, UDP, HTTP, and the like) or a stateful protocol (e.g., TCP, FTP, and the like).
When the cluster 120 receives a request from the one or more user device(s)110, the load balancer 130 may select a node from the one or more computing node(s) 140 to process the request. When selecting the node 140, the load balancer 130 may be configured to distribute the user devices 110′s request(s) to the computing nodes 140 based on a load balancing algorithm. The request can be further transferred to the selected node. The selected node can process the request and send a response to the user device 110 from which the request was originated.
FIG. 2 is a schematic 200 showing interaction of a user device 110 and the cluster 120, according to some example embodiments of the present disclosure. The user device 110 may send a request for a token to the cluster 120. The request for a token may include a user login and a user password of a user of the user device 110. The cluster 120 can be configured to generate a user security token and send the user security token to the user device 110. The request for the token can be forwarded to one of the computing nodes 140. The computing node 140 handling the request for the token may be configured to generate the user security token for the user device 110.
The user device 110 may send the user security token with a further request to the cluster 120. The further request can be forwarded to one of the computing nodes 140, which can be a different node than the computing node that generated the user security token. The computing node 140 may be configured to verify the user security token. If the user security token is valid, the computing node 140 may further process the further request to generate a response and send the response to the user device 110. The user security token can be used until it is invalidated. The user device 140 may be configured to send an indication to invalidate the user security token. The user security token can be also assigned an expiration time after which the user security token becomes invalid.
FIG. 3 is a block diagram showing modules of the system 300 for managing user security tokens, according to some example embodiments. The system 300 may include a token generation module 310, a token validation module 320, and a revoked token list 320. The modules of the system 300 can be implemented as instructions in memory of computing nodes 140 to be execute by the processors of the computing nodes 140.
The token generation module 310 may receive a request for a token from the user device(s) 110 and generate the user security token. The user security token may include an identifier, an information regarding the user device(s) 110 and/or a user of the user device 110, time of issue of the user security token, and an expiration time of the user security token. The length of the user security token may be selected to be as minimum as possible but still allow the computing node(s) 140 of the cluster 120 to retrieve information regarding the user device 110 from the user security token.
The user security token can be encrypted with authenticated encryption and formatted into an opaque string, which may include a ciphertext and a message authentication code (MAC). A system key or a generated key can be used in authenticated encryption. The key can be generated on the master node 150. The generated key can be further retrieved by the computing node(s) 140 for generating user security tokens. The key can be generated based on a shared secret between the nodes of the cluster 120. A new key can be generated immediately after each full restart of the cluster 120. As result, all user security tokens issued before the full restart become invalid. The new key may not be required to be generated during a rolling restart of applications on the computing nodes 140.
The token validation module 320 can be configured to receive the user security tokens from the user device(s) 110 and determine whether the user security tokens are valid or invalid. The user security token can be decrypted using a system key or a key generated at last restart of the cluster 120. The user security token can be valid if the expiration time of the user security token is not expired, the user security token is not found in the revoked token list 330, and the issue time of the user security token is not earlier than a predetermined time.
The token validation module 320 can be further configured to receive an indication to invalidate a user security token. Upon receiving the indication, the user security token can be added to the revoked token list 330. The user security token can be added to the revoked token list 330 even if the expiration time of the user security token is not expired. The revoked token list 330 can be further immediately replicated between the all the computing nodes 140 of the cluster 120. This may allow preventing reuse of a user security token by all nodes in cluster 120 after invalidating the use security token by one of the nodes. The revoked token list 330 can be also stored in a cluster state (for example, on the master node 150).
The indication to invalidate a security token may include a request from a user device(s) 110 to invalidate the user security token. The indication to invalidate the token may also include a request from an administrator of the cluster 120 to invalidate one or more of the user security tokens. The indication to invalidate one or more user security tokens can be also issued by one or more applications running on the cluster 120.
FIG. 4 is a flow chart of an example method 400 for invalidating security tokens, according to some example embodiments. The method 400 may be performed within environment 100 illustrated in FIG. 1. Notably, the steps recited below may be implemented in an order different than described and shown in the FIG. 4. Moreover, the method 400 may have additional steps not shown herein, but which can be evident to those skilled in the art from the present disclosure.
In block 405, the method 400 may commence with providing, by one or more nodes in a cluster, a list of revoked security tokens.
In block 410, the method 400 may proceed with receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user. The indication may include a request from a user to invalidate the user security token or a request from an administrator of the cluster 120 to invalidate the security token. The request for invalidating the user security can be also generated by one or more applications running on nodes of the cluster.
In block 415, the method 400 may proceed with adding, by the one or more nodes, the user security token to the list of revoked security tokens. The user security token can be added to the list of revoked security tokens before an expiration time of the user security token.
In block 420, the method 400 may proceed with replicating, by the one or more nodes, the list of revoked security tokens between further nodes of the cluster.
FIG. 5 illustrates an exemplary computer system 500 that may be used to implement some embodiments of the present disclosure. The computer system 500 of FIG. 5 may be implemented in the contexts of the likes of the user device(s) 110 and the load balancer 130, one or more computing node(s) 140, and a master node 150. The computer system 500 of FIG. 5 includes one or more processor units 510 and main memory 520. Main memory 520 stores, in part, instructions and data for execution by processor units 510. Main memory 520 stores the executable code when in operation, in this example. The computer system 500 of FIG. 5 further includes a mass data storage 530, portable storage device 540, output devices 550, user input devices 560, a graphics display system 570, and peripheral devices 580.
The components shown in FIG. 5 are depicted as being connected via a single bus 590. The components may be connected through one or more data transport means. Processor unit 510 and main memory 520 are connected via a local microprocessor bus, and the mass data storage 530, peripheral device(s) 580, portable storage device 540, and graphics display system 470 are connected via one or more input/output (I/O) buses.
Mass data storage 530, which can be implemented with a magnetic disk drive, solid state drive, or an optical disk drive, is a non-volatile storage device for storing data and instructions for use by processor unit 510. Mass data storage 530 stores the system software for implementing embodiments of the present disclosure for purposes of loading that software into main memory 520.
Portable storage device 540 operates in conjunction with a portable non-volatile storage medium, such as a flash drive, floppy disk, compact disk, digital video disc, or Universal Serial Bus (USB) storage device, to input and output data and code to and from the computer system 500 of FIG. 5. The system software for implementing embodiments of the present disclosure is stored on such a portable medium and input to the computer system 500 via the portable storage device 540.
User input devices 560 can provide a portion of a user interface. User input devices 560 may include one or more microphones; an alphanumeric keypad, such as a keyboard, for inputting alphanumeric and other information; or a pointing device, such as a mouse, a trackball, stylus, or cursor direction keys. User input devices 560 can also include a touchscreen. Additionally, the computer system 500 as shown in FIG. 5 includes output devices 550. Suitable output devices 550 include speakers, printers, network interfaces, and monitors.
Graphics display system 570 can include a liquid crystal display (LCD) or other suitable display device. Graphics display system 570 is configurable to receive textual and graphical information and process the information for output to the display device.
Peripheral devices 580 may include any type of computer support device to add additional functionality to the computer system.
The components provided in the computer system 500 of FIG. 5 are those typically found in computer systems that may be suitable for use with embodiments of the present disclosure and are intended to represent a broad category of such computer components that are well known in the art. Thus, the computer system 500 of FIG. 5 can be a personal computer (PC), handheld computer system, telephone, mobile computer system, workstation, tablet, phablet, mobile phone, server, minicomputer, mainframe computer, wearable, or any other computer system. The computer may also include different bus configurations, networked platforms, multi-processor platforms, and the like. Various operating systems may be used including UNIX, LINUX, WINDOWS, MAC OS, PALM OS, QNX, ANDROID, IOS, CHROME, TIZEN, and other suitable operating systems.
The processing for various embodiments may be implemented in software that is cloud-based. In some embodiments, the computer system 500 is implemented as a cloud-based computing environment, such as a virtual machine operating within a computing cloud. In other embodiments, the computer system 500 may itself include a cloud-based computing environment, where the functionalities of the computer system 500 are executed in a distributed fashion. Thus, the computer system 500, when configured as a computing cloud, may include pluralities of computing devices in various forms, as will be described in greater detail below.
In general, a cloud-based computing environment is a resource that typically combines the computational power of a large grouping of processors (such as within web servers) and/or that combines the storage capacity of a large grouping of computer memories or storage devices. Systems that provide cloud-based resources may be utilized exclusively by their owners or such systems may be accessible to outside users who deploy applications within the computing infrastructure to obtain the benefit of large computational or storage resources.
The cloud may be formed, for example, by a network of web servers that comprise a plurality of computing devices, such as the computer system 500, with each server (or at least a plurality thereof) providing processor and/or storage resources. These servers may manage workloads provided by multiple users (e.g., cloud resource customers or other users). Typically, each user places workload demands upon the cloud that vary in real-time, sometimes dramatically. The nature and extent of these variations typically depends on the type of business associated with the user.
The present technology is described above with reference to example embodiments. Therefore, other variations upon the example embodiments are intended to be covered by the present disclosure.

Claims

What is claimed is:

1. A method for invalidating user security tokens, the method comprising:

providing, by one or more nodes in a cluster, a list of revoked security tokens;

receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user; and

in response to the receiving, adding, by the one or more nodes, the user security token to the list of revoked security tokens.

2. The method of claim 1, further comprising replicating, by the one or more nodes, the list of revoked security tokens between further nodes of the cluster.

3. The method of claim 1, wherein the indication of invalidating of the user security token includes a request from the user to invalidate the user security token.

4. The method of claim 1, wherein the user security token includes information regarding the user, an issue time of the user security token, and an expiration time of the user security token.

5. The method of claim 4, wherein the user security token is added to the list of revoked security tokens prior to the expiration time of the user security token.

6. The method of claim 4, further comprising:

determining, by the one or more nodes, that the issue time precedes a predetermined time; and

in response to the determination, adding, by the one or more nodes, the user security token to the list of revoked security tokens.

7. The method of claim 1, wherein the user security token is encrypted using an authenticated encryption.

8. The method of claim 7, further comprising, upon a restart of the cluster, generating, by the one or more nodes, a key to be used for the authenticated encryption.

9. The method of claim 8, wherein the key is generated based on a shared secret between the one or more nodes of the cluster.

10. The method of claim 7, further comprising upon the restart of the cluster, invalidating, by the one or more nodes, previously issued user security tokens.

11. A system for invalidating user security tokens, the system comprising a cluster including one or more nodes configured to:

provide a list of revoked security tokens;

receive an indication of invalidating a user security token associated with a user; and

in response to the receiving the indication, add, by the one or more nodes, the user security token to the list of revoked security tokens.

12. The system of claim 11, wherein the one or more nodes is further configured to replicate the list of revoked security tokens between further nodes of the cluster.

13. The system of claim 11, wherein the indication of invalidating a user security token includes a request from the user to invalidate the user security token.

14. The system of claim 11, wherein the user security token includes information regarding the user, an issue time of the user security token, and expiration time of the user security token.

15. The system of claim 14, wherein the user security token is added to the list of revoked security tokens prior to the expiration time of the user security token.

16. The system of claim 14, wherein the one or more nodes is further configured to:

determine that the issue time of the user security token precedes a predetermined time; and

in response to the determination, add the user security token to the list of revoked security tokens.

17. The system of claim 11, wherein the user security token is encrypted using an authenticated encryption and a key.

18. The system of claim 17, wherein, upon the restart of the cluster, the one or more nodes are further configured to generate a key to be used for the authenticated encryption.

19. The system of claim 17, wherein, upon the restart of the cluster, the one or more nodes are further configured to invalidate previously issued security tokens.

20. A non-transitory computer-readable storage medium having embodied thereon instructions, which when executed by at least one processor, perform steps of a method, the method comprising:

receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user device; and

in response to the receiving the indication, adding, by the one or more nodes, the user security token to the list of revoked security tokens.